CVE-2022-21739: PYSEC-2026-3094 - Null pointer dereference in TensorFlow

CVE-2022-21739 · Severity: low · CVSS 3.1 · Published 2026-07-09

TensorFlow is a widely-used open-source machine learning library. The QuantizedMaxPool operation contains a vulnerability where specially crafted input parameters can cause a null pointer dereference, leading to application crashes and denial of service. An attacker can exploit this by providing malformed inputs to crash TensorFlow-based services.

Technologies: Google TensorFlow, tensorflow (PyPI), tensorflow-cpu (PyPI), tensorflow-gpu (PyPI). Vendors: Google, PyPI.

Quick answers

Is CVE-2022-21739 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-21739 being exploited in the wild.
How severe is CVE-2022-21739?
Low severity, with a CVSS score of 3.1, published 9 July 2026.
Which products and versions are affected?
Google TensorFlow All versions before 2.5.3; 2.6.0–2.6.2; 2.7.0; tensorflow (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.3,introduced=2.6.0,fixed=2.6.3,introduced=2.7.0,fixed=2.7.1; tensorflow-cpu (PyPI) GIT:introduced=0,fixed=53b0dd6dc5957652f35964af16b892ec9af4a559|ECOSYSTEM:introduced=0,fixed=2.5.3,introduced=2.6.0,fixed=2.6.3; tensorflow-gpu (PyPI) GIT:introduced=0,fixed=53b0dd6dc5957652f35964af16b892ec9af4a559|ECOSYSTEM:introduced=0,fixed=2.5.3,introduced=2.6.0,fixed=2.6.3.
Is there a fix for CVE-2022-21739?
Yes. tensorflow (PyPI): upgrade to 2.7.1 or later; tensorflow-cpu (PyPI): upgrade to 2.6.3 or later; tensorflow-gpu (PyPI): upgrade to 2.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-21739 attacked?
It is attacked over the network or with local access.
Am I affected by CVE-2022-21739?
Check whether you run Google TensorFlow, tensorflow (PyPI), tensorflow-cpu (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tensorflow (PyPI): upgrade to 2.7.1 or later
    pip install "tensorflow>=2.7.1"
  • tensorflow-cpu (PyPI): upgrade to 2.6.3 or later
    pip install "tensorflow-cpu>=2.6.3"
  • tensorflow-gpu (PyPI): upgrade to 2.6.3 or later
    pip install "tensorflow-gpu>=2.6.3"

Technical details

The vulnerability is a null pointer dereference (CWE-476) in the QuantizedMaxPool operation within TensorFlow's quantized pooling kernel. The root cause is a reference binding to a null pointer when user-controlled inputs (min_input and max_input tensors) are empty or malformed. An attacker with the ability to call TensorFlow operations (local or via an exposed ML inference API) can trigger this by providing an empty min_input or max_input parameter while executing QuantizedMaxPool. Successful exploitation causes an undefined behavior condition that typically results in a crash, achieving denial of service. Patches are available in TensorFlow 2.5.3, 2.6.3, 2.7.1, and 2.8.0.

Affected products

  • Google TensorFlow All versions before 2.5.3; 2.6.0–2.6.2; 2.7.0
  • Google TensorFlow CPU All versions before 2.5.3; 2.6.0–2.6.2; 2.7.0
  • Google TensorFlow GPU All versions before 2.5.3; 2.6.0–2.6.2; 2.7.0

Identifiers

  • CVE-2022-21739
  • GHSA-3mw4-6rj6-74g5
  • PYSEC-2022-118
  • PYSEC-2022-63
  • PYSEC-2026-3094

Timeline

  • 2022-02-02: disclosed: Advisory published by TensorFlow security team
  • 2022-02-09: patched: Patch released in TensorFlow 2.5.3, 2.6.3, 2.7.1, and 2.8.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.